Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: cancel sched scan results work on unregister cfg80211schedscanresults can queue rdev-schedscanreswk from a driver result notification while a scheduled scan request is present. The work callback recovers the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: rt2x00: avoid full teardown before work setup in probe rt2x00libprobedev uses the full rt2x00libremovedev teardown for all probe failures. However, drvdata allocation and workqueue allocation can fail before intfwork,...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Check card index validity at probe The aloop driver blindly trusts that the given devptr-id value is within the proper card index range during probe. It’s acceptable for the devices created by the driver itself at th...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix listdel corruption in kfdcriuresumesvm The cleanup tail of kfdcriuresumesvm walks svms-criusvmmetadatalist and kfrees each struct criusvmmetadata without removing them from the list. The list head remains pointing...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: jfs: Added a check for read-only mode prior to truncation in jfstruncatenolock A check for “read-only” mode was added to the jfstruncatenolock function to prevent errors related to writing to a read-only filesystem. Call stack:...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ASoC: fsl: fslaudmix: Validate written enum values fslaudmixputmixclksrc and fslaudmixputoutsrc convert the user-provided enum item using sndsocenumitemtoval before checking whether the item is within the enum’s allowed range. Th...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: drm/panel-edp: fix i2c adapter leak on probe failure Make sure to drop the i2c adapter reference on probe failure e.g., probe deferral and on driver unbind as well; if a device tree redundantly uses the ‘ddc-i2c-bus’ property to...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: gro: properly validate BIG TCP aggregation criteria When GRO attempts to aggregate packets beyond GROLEGACYMAXSIZE 64KB, BIG TCP should only be permitted for plain IPv4 TCP and plain IPv6 TCP with sufficient MAC header room ...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/ncsi: fix heap OOB read in NCSICMDSENDCMD payload length ncsisendcmdnl takes the number of bytes to copy from the attacker-controlled ncsipkthdr.length field of the in-band packet header, while the source buffer is the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: Fix UAF at error handling during probe Although the 6fire driver had a few fixes for dealing with the early error handling during the probe phase, it forgot to release pending URBs before freeing resources, which may...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Fix frags overflow by bounding framecount tbnetpoll assembles a multi-frame ThunderboltIP packet into one skb. The first frame goes into the skb linear area and every further frame is added as a page fragment...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: NFSv4/pnfs: key the data server cache on the NFS version nfs4pnfsdsadd keys the per-net data server cache on the multipath address set alone, and struct nfs4pnfsds records no version. That suffices for the files layout driver,...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: atomically update mac addresses When a MAC address is updated in batadvdatentryadd, it is done using a simple copy function. A parallel reader might only see parts of this update. In the worst case, the reader is...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Fix PBL chunk length computation On register MR, when creating a PBL, if it is an indirect PBL, we create a chunk list to store the pointers to PBL pages. Each chunk is 4KB in size and can hold 510 addresses...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpfitertcpestablishedbatch reqskqueuehashreq publishes a TCPNEWSYNRECV requestsock onto the ehash chain, drops the bucket lock, and only afterwards sets rskrefcnt to 3. Lockless readers such as...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ibmvnic: Use kernel helpers for hex dumps Previously, when the driver printed hex dumps, the buffer was cast to an 8 byte long and printed using string formatters. If the buffer size was not a multiple of 8, a read buffer overflo...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Free RX data on late probe failure hfi1initdd allocates the shared AIP/VNIC RX support before returning. If hfi1init or hfi1registeribdevice later fails, initone tears down the device data without calling hfi1freerx...

Astra Linux – vulnerability in linux-6.12, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: fix NULL pointer dereference in l3mdevl3rcv When delete l3s ipvlan: ip link del link eth0 ipvlan1 type ipvlan mode l3s This may cause a null pointer dereference: Call trace: iprcvfinish+0x48/0xd0 iprcv+0x5c/0x100...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: isofs: release zisofs block pointer buffer head zisofsfillpages reads the compressed block pointer table. The error paths release the current bufferhead; the loop also releases the old bufferhead when it advances. However, the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: KVM: Move kvmiobusgetdev locking responsibilities to callers kvmiobusgetdev returns a device that is only matched by the address, and nothing else. This can cause a lifetime issue if the matched device is not the expected type, a...